Kill EDR from kernel space with a vulnerable driver

Protected Process Light stops user-mode code from opening or killing EDR processes. Bring Your Own Vulnerable Driver loads a legitimately signed driver with an arbitrary read/write or process-terminate primitive, then uses it to remove the protection or terminate the sensor from ring 0.

# load the signed-but-flawed driver as a service, then feed it target PIDs
sc create vuln type= kernel binPath= C:ProgramDatavuln.sys
sc start vuln

Drive the primitive from a small loader that enumerates and disables the security stack.

# open-source loaders map a PID to the driver's terminate/IOCTL and clear the PPL flag

Pro note: the Microsoft vulnerable-driver blocklist and HVCI now catch the well-known drivers, so pick one not yet on the list and confirm the target has not enabled the blocklist. Loading any driver is loud in its own right, so time it for when the sensor is already partly blinded.